KillSec Ransomware Strikes Brazilian Healthcare Provider, Exposing Patient Data

According to Resecurity, KillSec ransomware targeted MedicSolution, a healthcare software provider in Brazil, compromising the exposure of over 34 GB of data and more than 94,818 files containing sensitive patient information. The group has claimed responsibility and threatened to leak data unless negotiations are started promptly. By attacking a major element of the healthcare IT supply chain, Resecurity notes that KillSec multiplied its impact compared with an attack on a single target.

The exposed data include medical evaluations, lab results, X-rays, unredacted patient photos (including minors), and sensitive medical assessments. Resecurity’s investigation identified that some of the stolen files were stored in exposed AWS cloud buckets, with the data not contained at the time of the ransomware claims. The findings have been shared with CERT[.]br and Brazil’s ANPD for containment and enforcement.